HTTP Anti-Virus Proxy

Hi,

I use Firefox and it work very fine with HAVP and ClamAV like scanner.
I have tried if it detect some virus on (http://testvirus.de/de/liste.html)
and it work very fine and all virus are rightly detected.
But if I try it on(www.eicar.org) it detect only the zipped file but not the
*.com and the *.txt, firefox let me download them without any problem!
If I try to make it with Internet Explorer HAVP identfy the virus in all types
of file(*.com, *.txt, *.zip, ecc.).

Where I wrong ?

Are you sure your IE cache is cleaned? I can't think of another reason..

Cheers,
Henrik

Same problem here, reproductible.

havp detects virus and eicars (can see virus names in logfiles) but they still pass.

Tested browser/os:
mozilla/win32 => squid + havp parent: eicar and virus goes throught
firefox/linux => squid + havp parent: eicar and virus goes throught
IE/win32 => squid + havp parent: eicar and virus blocked

If you switch havp and squid: it works
mozilla/win32 => havp + squid parent: eicar and virus blocked
firefox/linux => havp + squid parent: eicar and virus blocked
IE/win32 => havp + squid parent: eicar and virus blocked.

All caches are cleaned before testing, squid is running with no cache also (cache_dir null and so on).

Can you try this version, perhaps it's because of a certain bug that slipped through in 0.79..

http://havp.hege.li/download/havp-0.80.tar.gz

Cheers,
Henrik

The issue is only with clam...

I switched to f-prot (zero configuration changes except disabeling clamd en enabeling fprotd in havp.conf) and it works with all browsers.

I'll try your 0.80 release soon.

Bye,
Mat.

Bug still there with 0.80 release.

I can't reproduce it either way. Could you send me HAVP config, squid config/version and ClamAV version with PM or havp@hege.li. Then I might have better luck.

Cheers,
Henrik

Use latest stable squid and it works.

It's not a havp bug

/usr/local/squid/sbin/squid -v
Squid Cache: Version 2.5.STABLE14
configure options: --prefix=/usr/local/squid --enable-async-io=128 --with-pthreads --with-aio --enable-storeio=ufs,aufs,diskd,null --enable-linux-netfilter --enable-removal-policies=lru,heap --enable-snmp --enable-delay-pools --enable-poll --enable-cache-digests --enable-underscores --enable-referer-log --enable-useragent-log --with-maxfd=15000 --with-large-files --enable-large-cache-files

all browsers/all av engines (clam/f-prot tested) do works.

Bye,
Mat.

I tried it today with HAVP 0.79 and libclamav 0.88.2 -- no squid -- and recent daily.cvd and it blocked all the Eicar viruses over HTTP, as it did the day I installed HAVP (a few days ago).

Perhaps your problem is the "clamav-like" scanner? (Or maybe your Firefox proxy config is funny?)

P.S. I also have Privoxy between browsers and HAVP, but I doubt that matters.